Hyperliquid vs KuCoin

Hyperliquid 39

Read as a closed hosted service with open SDKs. The API has no dated changelog, so the last dated change is the Python SDK's 0.24.0 on 4 June 2026, 152 days before this check; the node repository was pushed on 10 August 2026 and the docs describe newer actions (HIP-4 outcome markets, borrow and lend) without dates. Judgement call (10 of 30). No three dated releases in 90 days (0). Support through Discord and the docs' FAQ, 112 open issues on the SDK whose replies couldn't be read (8 of 25). Official Python and Rust SDKs, the Rust one last pushed 21 October 2025; no MCP registry entry (15). CI on Python 3.9 and 3.13 with Poetry, Dependabot badge, a lock file (6 of 10). Total 39.

KuCoin 73

Read as a closed hosted service. The changelog's newest past entry is 2 November 2026 and the universal SDK was pushed 15 September (30). Nine dated changelog entries since 5 August 2026 (20). A Telegram API group (t.me/KuCoin_API) and api@kucoin.com for limit requests, no public issue tracker for the API; the SDK repository's issues were not checked (10 of 25). Official SDKs current in five languages, no MCP registry presence (13 of 15). No package health signal checked (0 of 10). 73.

Hyperliquid 26

The editorial half. The SDKs are MIT and the node repository Apache-2.0 with a Dockerfile around a binary; the API servers and front end are closed and the terms were unreadable (12 of 30). No privacy policy read and nothing in the docs on data handling (0 of 30). Deprecated actions are marked in the docs without dates or a policy (8 of 20). No subprocessors or data locations (0 of 20). Total 20.

KuCoin 54

The editorial half. A closed hosted service with terms that are clear on use, liability and law but name no company (12 of 30). The privacy policy gives retention periods by purpose and provider (2 years after closure, 14 months for Firebase, 3 years for Jumio, 5 years for Sumsub) and names 41 services, with no data centre locations (22 of 30). Endpoints are removed and fields deprecated in dated changelog entries with no notice period or policy (8 of 20). Third parties named by service, locations not stated beyond transfers around the globe (10 of 20). 52.

Hyperliquid 55

No machine payment protocol (0). Fees published per tier without login (20). No card anywhere; public info endpoints are free and the testnet faucet gives 1,000 mock USDC, though only to an address that has deposited on mainnet (15 of 20). No signup; an agent with a funded EVM wallet deposits USDC on a bridged chain and trades, subject to the unread terms (20). Total 55.

KuCoin 35

No machine payment protocol (0). The spot base fee is stated in support articles without login, the futures base rate and the full tier table sit in images or behind script (15 of 20). Market data needs no key, no card is asked for at sign-up (20). A person registers, verifies identity and mints the key in a browser (0). 35.

Hyperliquid 42

No OpenAPI or other machine-readable contract; request and response shapes are tables and JSON examples in the docs (0 of 25). llms.txt and a Markdown twin of every page by appending .md (10). Each info type and exchange action has a short description of what it does, and the signing page lists common mistakes, but little says when to use one call over another (12 of 20). Fields are one-letter keys (a, b, p, s, r, t, c) with numbers as strings, enums such as tif Alo, Ioc or Gtc, and required fields marked in tables (9 of 15). An example for every call and a list of order and cancel error strings, with no HTTP error table (11 of 15). No API version, no changelog and no dated release notes; deprecated actions such as userDexAbstraction are marked in place (0 of 15). Total 42.

KuCoin 60

No OpenAPI or other machine-readable contract was found; the docs link a Postman workspace and the universal SDK is generated from an internal spec (8 of 25). No llms.txt; the skills hub ships Markdown SKILL.md files with endpoint tables for seven product areas, read-only (6 of 10). One docs page per endpoint with a description, permission and weight, but no when-to-use guidance (12 of 20). Typed parameter tables with enums for type and side and required flags (11 of 15). Request and response examples per endpoint and a unified six-digit error code scheme introduced with V2 (10 of 15). Dated changelog with V1 to V2 versioning (13 of 15). 60.

Hyperliquid 64

No shared secrets. Actions are signed by the wallet key or by an API wallet the master approves with a name and optional expiry; API wallets can only sign, withdrawals and external sends are user-signed, and approving a new wallet deregisters the old. No IP allow-list or address allow-list (24 of 30). An API wallet is a trading-only credential and info needs no key, but nothing limits order size or marks an action as needing approval (10 of 20). The API returns no untrusted content (10). Fills, historical orders, userRole and nonces are queryable per account; no per-wallet action log (8 of 15). A bug bounty run by the Hyper Foundation with rewards up to under 1 million USDC, a Zellic audit of the bridge contract, a SECURITY.md on the SDK; no security.txt (403), no SOC 2 (12 of 20). Total 64.

KuCoin 55

API key with a user-set passphrase, HMAC-SHA256 signing, nine permission groups, IP allow-lists required for Withdrawal and FlexTransfers, trading keys without an IP disabled after 30 days of inactivity, revocation on the management page; no OAuth and no expiry on General keys (24 of 30). A General-only key is a true read-only mode and withdrawals are a separate permission; no confirmation step for writes beyond the key scope (12 of 20). Tools return the exchange's own data (10). The API key info endpoint shows permissions and IP lists; no per-call audit log was found (5 of 15). No security.txt, no disclosure policy or bounty on a page we could read, a whistleblower notice on the legal page (4 of 20). 55.

Hyperliquid 70

An API, read for response sizing. Time-range calls return at most 500 blocks of data, fills and historical orders cap at 2,000 items, candles at 5,000, l2Book at 20 levels a side (18 of 25). Cursor-by-timestamp pagination on fills and funding, filtering by coin or dex, no field selection (14 of 20). Order errors are documented strings per order, one batch-level error rejects a batch, and orderStatus answers unknownOid; no codes and no rate-limit error shape (12 of 20). cloid, per-signer nonces within a time window, expiresAfter, noop to burn a nonce and scheduleCancel as a dead man's switch (18 of 20). Few required fields, but signing needs msgpack field order, two EIP-712 schemes and lowercase addresses, and the official SDKs are Python (Alpha) and Rust only (8 of 15). Total 70.

KuCoin 62

Read for the API alone, since there is no MCP server. Responses take limit and cursor parameters on list endpoints and the order book depth is a parameter (14 of 25). Pagination and symbol filters on orders, fills and ledgers (15 of 20). Codes and messages per response, with the V2 scheme claimed to be clearer; the rate-limit page's own examples contradict its table, which costs an agent a turn (12 of 20). clientOid on orders makes retries safe; no MCP annotations to read (10 of 20). Three required fields on a spot order, official SDKs in five languages (11 of 15). 62.